pkcs11-keygen.docbook revision a7d4d528749aa403397b3e2260abf2046a0cfa7b
f743002678eb67b99bbc29fee116b65d9530fec0wrowe<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
80833bb9a1bf25dcf19e814438a4b311d2e1f4cffuankg "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
a34684a59b60a4173c25035d0c627ef17e6dc215rpluem [<!ENTITY mdash "—">]>
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic - Copyright (C) 2009, 2014 Internet Systems Consortium, Inc. ("ISC")
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic - Permission to use, copy, modify, and/or distribute this software for any
4da61833a1cbbca94094f9653fd970582b97a72etrawick - purpose with or without fee is hereby granted, provided that the above
4da61833a1cbbca94094f9653fd970582b97a72etrawick - copyright notice and this permission notice appear in all copies.
4da61833a1cbbca94094f9653fd970582b97a72etrawick - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
4da61833a1cbbca94094f9653fd970582b97a72etrawick - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
4789804be088bcd86ae637a29cdb7fda25169521jailletc - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
4789804be088bcd86ae637a29cdb7fda25169521jailletc - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
4789804be088bcd86ae637a29cdb7fda25169521jailletc - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
4789804be088bcd86ae637a29cdb7fda25169521jailletc - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
e50c3026198fd496f183cda4c32a202925476778covener - PERFORMANCE OF THIS SOFTWARE.
5b88c8507d5ef6d0c4cfbc78230294968175b638minfrin <refentryinfo>
6c3b9cebb551140fbb25d58bae08b539b3802133ylavic </refentryinfo>
4f29b65ab4b547ad5dbe506e2d0ff5d12ead9247ylavic <refentrytitle><application>pkcs11-keygen</application></refentrytitle>
69301145375a889e7e37caf7cc7321ac0f91801erpluem <refnamediv>
69301145375a889e7e37caf7cc7321ac0f91801erpluem <refname><application>pkcs11-keygen</application></refname>
69301145375a889e7e37caf7cc7321ac0f91801erpluem <refpurpose>generate keys on a PKCS#11 device</refpurpose>
506bfe33206b2fece40ef25f695af39dd4130facjkaluza </refnamediv>
506bfe33206b2fece40ef25f695af39dd4130facjkaluza <copyright>
d58a848a016d401b965111e50ef829e1641f7834minfrin <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
2e6f4d654c96c98b761fb012fd25c5d5b1558c44sf </copyright>
2e6f4d654c96c98b761fb012fd25c5d5b1558c44sf </docinfo>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <refsynopsisdiv>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <cmdsynopsis>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <arg choice="req">-a <replaceable class="parameter">algorithm</replaceable></arg>
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic <arg><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavic <arg><option>-i <replaceable class="parameter">id</replaceable></option></arg>
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavic <arg><option>-m <replaceable class="parameter">module</replaceable></option></arg>
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic <arg><option>-p <replaceable class="parameter">PIN</replaceable></option></arg>
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic <arg><option>-s <replaceable class="parameter">slot</replaceable></option></arg>
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic </cmdsynopsis>
d7205b1a86c51c27b71a2c458dc453fd53a261c1covener </refsynopsisdiv>
44ff304057225e944e220e981d434a046d14cf06covener <command>pkcs11-keygen</command> causes a PKCS#11 device to generate
44ff304057225e944e220e981d434a046d14cf06covener a new key pair with the given <option>label</option> (which must be
44ff304057225e944e220e981d434a046d14cf06covener unique) and with <option>keysize</option> bits of prime.
5d1ba75b8794925e67591c209085a49279791de9covener </refsect1>
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrand <variablelist>
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrand <varlistentry>
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrand <term>-a <replaceable class="parameter">algorithm</replaceable></term>
caad2986f81ab263f7af41467dd622dc9add17f3ylavic Specify the key algorithm class: Supported classes are RSA,
caad2986f81ab263f7af41467dd622dc9add17f3ylavic DSA, DH, and ECC. In addition to these strings, the
45a10d38e6051fd7bdf9d742aaae633d97ff02abjailletc <option>algorithm</option> can be specified as a DNSSEC
f7317ff316c2b141feea31bddb74d5d3fa1584edjorton signing algorithm that will be used with this key; for
f7317ff316c2b141feea31bddb74d5d3fa1584edjorton example, NSEC3RSASHA1 maps to RSA, and ECDSAP256SHA256 maps
2165214331e4afafca4048f66f303d0253d7b001covener to ECC. The default class is "RSA".
a34684a59b60a4173c25035d0c627ef17e6dc215rpluem </listitem>
1e2d421a36999d292042a5539971070d54aa6c63ylavic </varlistentry>
1e2d421a36999d292042a5539971070d54aa6c63ylavic <varlistentry>
fa7ed98b9dc94c5845cf845aea0a44ecacd290c9humbedooh <term>-b <replaceable class="parameter">keysize</replaceable></term>
0b67eb8568cd58bb77082703951679b42cf098actrawick Create the key pair with <option>keysize</option> bits of
0b67eb8568cd58bb77082703951679b42cf098actrawick prime. For ECC keys, the only valid values are 256 and 384,
0b67eb8568cd58bb77082703951679b42cf098actrawick and the default is 256.
5ef3c61605a3a021ff71f488983cb0065f8e1a79covener </listitem>
fb1985a97912b25ec6564c73e610a31e5fc6e25fcovener </varlistentry>
6502b7b32f980cc2093bb3ebce37e5e4dc68fba4ylavic <varlistentry>
c1a63b8fad09c419c1a64f75993feb8a343a6801ylavic For RSA keys only, use a large exponent.
e6b4bd1113567627ab6bb6c6a7105e1e01a7d889jailletc </listitem>
e6b4bd1113567627ab6bb6c6a7105e1e01a7d889jailletc </varlistentry>
e466c40e1801982602ee0200c9e8b61cc148742djailletc <varlistentry>
457468b82e59d01eba00dd9d0817309c8f5e414ejim <term>-i <replaceable class="parameter">id</replaceable></term>
457468b82e59d01eba00dd9d0817309c8f5e414ejim <listitem>
04983e3bd1754764eec7d6bb772fe3b0bf391771jorton Create key objects with id. The id is either
04983e3bd1754764eec7d6bb772fe3b0bf391771jorton an unsigned short 2 byte or an unsigned long 4 byte number.
15660979a30d251681463de2e0584853890082accovener </listitem>
15660979a30d251681463de2e0584853890082accovener </varlistentry>
49dacedb6c387b786b7911082ff35121a45f414bcovener <varlistentry>
cfd9415521847b2f9394fad04fb701cfb955f503rjung <term>-m <replaceable class="parameter">module</replaceable></term>
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe Specify the PKCS#11 provider module. This must be the full
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe path to a shared library object implementing the PKCS#11 API
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe for the device.
28c31fb73c1264bd1d0ff932573677030b024c7dwrowe </listitem>
8491e0600f69b0405e156ea8a419653c065c645bcovener </varlistentry>
63b9f1f5880391261705f696d7d65507bbe9ace3covener <varlistentry>
49dacedb6c387b786b7911082ff35121a45f414bcovener Set the new private key to be non-sensitive and extractable.
49dacedb6c387b786b7911082ff35121a45f414bcovener The allows the private key data to be read from the PKCS#11
3c990331fc6702119e4f5b8ba9eae3021aea5265jim device. The default is for private keys to be sensitive and
3c990331fc6702119e4f5b8ba9eae3021aea5265jim non-extractable.
3c990331fc6702119e4f5b8ba9eae3021aea5265jim </listitem>
fc42512879dd0504532f52fe5d0d0383dda96a1eniq </varlistentry>
fc42512879dd0504532f52fe5d0d0383dda96a1eniq <varlistentry>
0451df5dc50fa5d8b3e07d92ee6a92e36a1181a5niq <term>-p <replaceable class="parameter">PIN</replaceable></term>
0451df5dc50fa5d8b3e07d92ee6a92e36a1181a5niq <listitem>
da0442c0440caef34706e2c2f3af05cb65921cc0jailletc Specify the PIN for the device. If no PIN is provided on
983528026996668ea295be95aedb9c7a346af470ylavic the command line, <command>pkcs11-keygen</command> will
da0442c0440caef34706e2c2f3af05cb65921cc0jailletc prompt for it.
06b8f183140c8e02e0974e938a05078b511d1603covener </listitem>
06b8f183140c8e02e0974e938a05078b511d1603covener </varlistentry>
15890c9306ba98f6fc243e15a3c4778ddc7d773erpluem <varlistentry>
259878293a997ff49f5ddfc53d3739cbdc25444ecovener Quiet mode: suppress unnecessary output.
b54b024c06a19926832d77d40ba35ad8c41e4d3dminfrin </listitem>
b54b024c06a19926832d77d40ba35ad8c41e4d3dminfrin </varlistentry>
65967d05f839dbf27cf91d91fa79585eeae19660minfrin <varlistentry>
8152945ae46857b170cb227e79bb799f4fc7710dminfrin For Diffie-Hellman (DH) keys only, use a special prime of
8152945ae46857b170cb227e79bb799f4fc7710dminfrin 768, 1024 or 1536 bit size and base (aka generator) 2.
8152945ae46857b170cb227e79bb799f4fc7710dminfrin If not specified, bit size will default to 1024.
75f5c2db254c0167a0e396254460de09b775d203trawick </listitem>
75f5c2db254c0167a0e396254460de09b775d203trawick </varlistentry>
4f0358189bfa57b8e75bd6b94db264302a8f336amrumph <varlistentry>
4f0358189bfa57b8e75bd6b94db264302a8f336amrumph <term>-s <replaceable class="parameter">slot</replaceable></term>
5716f9c6daa92dde5f2f9d11ed63f7c9549c223atrawick Open the session with the given PKCS#11 slot. The default is
54d750a84a175d8e338880514d440773eb986b50covener </listitem>
54d750a84a175d8e338880514d440773eb986b50covener </varlistentry>
54d750a84a175d8e338880514d440773eb986b50covener </variablelist>
54d750a84a175d8e338880514d440773eb986b50covener </refsect1>
54d750a84a175d8e338880514d440773eb986b50covener <citerefentry>
54d750a84a175d8e338880514d440773eb986b50covener <refentrytitle>pkcs11-destroy</refentrytitle><manvolnum>8</manvolnum>
83b50288fa7d306324bba68832011ea08f5c7832covener </citerefentry>,
4e30ef014533a7e93c92d88306291f5e49c9692ftrawick <citerefentry>
83b50288fa7d306324bba68832011ea08f5c7832covener <refentrytitle>pkcs11-list</refentrytitle><manvolnum>8</manvolnum>
5f066f496cd9f20a2a701255bc67d44e7cb46daetrawick </citerefentry>,
5f066f496cd9f20a2a701255bc67d44e7cb46daetrawick <citerefentry>
5f066f496cd9f20a2a701255bc67d44e7cb46daetrawick <refentrytitle>pkcs11-tokens</refentrytitle><manvolnum>8</manvolnum>
2e15620d724fb8e3a5be183b917359a2fd6e9468covener </citerefentry>,
2e15620d724fb8e3a5be183b917359a2fd6e9468covener <citerefentry>
2e15620d724fb8e3a5be183b917359a2fd6e9468covener <refentrytitle>dnssec-keyfromlabel</refentrytitle><manvolnum>8</manvolnum>
2e15620d724fb8e3a5be183b917359a2fd6e9468covener </citerefentry>
1b988c41ee505962781d110a3e4c2c90f1ea0aa4covener </refsect1>
b8efdc95bec9cf089aa1be0bfd07d46aa1137a7acovener <para><corpauthor>Internet Systems Consortium</corpauthor>
f06e7c4b1bce6b6491e5de0b7998d3f5696b293dchrisd </refsect1>
179565be4043d7e5f9161aa75271fa0a001866d9covener - Local variables:
179565be4043d7e5f9161aa75271fa0a001866d9covener - mode: sgml